Connect using Public IP

Preview — Connect using Public IP

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page summarizes how to connect to databases served by AlloyDB for PostgreSQL using Public IP.

You can configure your AlloyDB instance to have a public IPv4 address and accept connections from specific external IP addresses or a range of addresses, called authorized external networks. These authorized networks are only available when using public IP. You can't specify a private network as an authorized network.

AlloyDB only supports inbound connections. You can configure your instance for outbound public IP connectivity using private IP and an intermediary VM. For more information on outbound connections, see connect to a cluster from outside its VPC.

Note: AlloyDB doesn't support creating a new instance with public IP enabled. To use public IP on your instance, create an instance, then update the instance to enable public IP. For more information on how to create an instance, see Create a primary instance.

Enable public IP on an instance

When you enable public IP on your instance, AlloyDB configures the instance with a public, static IPv4 address. You can also provide a comma-separated list of authorized networks that can connect to your instance using the public IPv4 address.

You can either:

• Only enable public IP
• Both enable public IP and add authorized networks to your instance

Note: Enabling public IP on an instance restarts the AlloyDB Auth Proxy and drops all existing connections.

To enable public IP, run the following command:

gcloud

To use the gcloud CLI, you can install and initialize the Google Cloud CLI, or you can use Cloud Shell.

Use the gcloud alloydb instances update command to enable public IP on your instance.

gcloud beta alloydb instances update INSTANCE_ID \
    --cluster=CLUSTER_ID  \
    --region=REGION_ID  \
    --assign-inbound-public-ip=ASSIGN_IPV4

To enable public IP and add authorized networks to your instance, run the following command:

gcloud

To use the gcloud CLI, you can install and initialize the Google Cloud CLI, or you can use Cloud Shell.

Use the gcloud alloydb instances update command to enable public IP on your instance.

gcloud beta alloydb instances update INSTANCE_ID \
    --cluster=CLUSTER_ID  \
    --region=REGION_ID  \
    --assign-inbound-public-ip=ASSIGN_IPV4 \
    --authorized-external-networks=CIDR_RANGE1,CIDR_RANGE2,...

For each CIDR_RANGE, enter a CIDR block, such as 192.168.0.0/16.

Disable public IP on an instance

When you disable public IP on your instance, AlloyDB removes the public IP address from your instance and clears the authorized networks list. Authorized networks can only be used with public IP.

To disable public IP, run the following command:

gcloud

To use the gcloud CLI, you can install and initialize the Google Cloud CLI, or you can use Cloud Shell.

Use the gcloud alloydb instances update command to enable public IP on your instance.

gcloud beta alloydb instances update INSTANCE_ID \
    --cluster=CLUSTER_ID  \
    --region=REGION_ID  \
    --assign-inbound-public-ip=NO_PUBLIC_IP

Update the authorized networks for an instance

You can update the list of authorized networks on your instance at any time. Public IP must be enabled on your instance when updating the authorized networks list.

Authorized networks can't be added or removed individually, and the networks list is overridden each time the update list command is run. To update authorized networks on your instance, you'll need to provide a comma-separated list of all authorized networks each time you want to add or remove a network. Each authorized network must be in CIDR format.

To update the list of authorized networks on your instance, run the following command:

gcloud

To use the gcloud CLI, you can install and initialize the Google Cloud CLI, or you can use Cloud Shell.

Use the gcloud alloydb instances update command to enable public IP on your instance.

gcloud beta alloydb instances update INSTANCE_ID \
    --cluster=CLUSTER_ID  \
    --region=REGION_ID  \
    --authorized-external-networks=CIDR_RANGE1,CIDR_RANGE2,...

View public IP address and authorized external network for an instance

You can view the list of authorized networks on your instance at any time and the assigned public IP address using the gcloud alloydb instances describe command.

To view the list of authorized networks, run the following command:

Console

1. Go to the Clusters page.

   Go to Clusters

2. Click a cluster in the Resource Name column.

3. Go to the Instances in your cluster section.

You can find the Public IP resource that shows the public IP address and the Authorized External Networks resource that shows the authorized external network range, if configured.

gcloud

To use the gcloud CLI, you can install and initialize the Google Cloud CLI, or you can use Cloud Shell.

gcloud beta alloydb instances describe $INSTANCE_ID \
--cluster=CLUSTER_ID \
--region=REGION_ID

What's next

• Connection overview
• Connect using the AlloyDB Auth Proxy